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Abstract 

In this paper we consider the problem of secure network coding where an adversary has access to an unknown 
subset of links chosen from a known collection of links subsets. We study the capacity region of such networks, 
commonly called "wiretap networks", subject to weak and strong secrecy constraints, and consider both zero-error 
and asymptotically zero-error communication. We prove that in general discrete memoryless networks modeled by 
• discrete memoryless channels, the capacity region subject to strong secrecy requirement and the capacity region 

■ subject to weak secrecy requirement are equal. In particular, this result shows that requiring strong secrecy in a 

£ — , wiretap network with asymptotically zero probability of error does not shrink the capacity region compared to the 

case of weak secrecy requirement. We also derive inner and outer bounds on the network coding capacity region 
of wiretap networks subject to weak secrecy constraint, for both zero probability of error and asymptotically zero 
probability of error, in terms of the entropic region. 
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I. Introduction 



j> | We consider the problem of network coding subject to secrecy constraints. The communication medium consists 

of an error-free network of directed point-to-point links. An adversary eavesdrops on an unknown subset of links 



chosen from a given collection of subsets. A typical example of such a collection is the set of all subsets of links 



in 
oo 
rn 

' containing at most r links. The selected edges are not known to the communicating users, and the goal is to 

maximize the communication rates while not leaking information to the eavesdropper. 



Different notions of security have been considered in the literature, most of which can be categorized as either 
computational security or information theoretic security. In this paper, we focus on the latter, where the information 
leakage is measured in terms of the mutual information between the adversary's observations and the sources' 
messages. Notions of perfect secrecy, strong secrecy and weak secrecy are defined in terms of how fast this mutual 
information is required to approach zero. If the mutual information between the source messages and the adversary's 
observations is exactly equal to zero, then the system is perfectly secure. That is, the source data and the information 
available to the adversary are completely independent. In the case of strong secrecy, the described mutual information 
is required to get arbitrarily small as the blocklength grows, which implies almost independence. Finally, in the 
weak secrecy model, the mutual information is normalized by the blocklength, and hence the "rate" of leakage is 
required to be arbitrarily small. 

The problem of information theoretically secure communication was introduced by Shannon in [1]. He consid- 
ered a point to point public channel, where a transmitter wants to send message M uniformly distributed over 
{!,..., 2 nRa } to a receiver. A random key that is uniformly distributed over {!,..., 2 nRk } is available to both of 
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them. The transmitter encodes its message M using key K into codeword W = W(M, K). The adversary observes 
the encoded codeword W sent over the public channel, but does not have access to K. To ensure perfect secrecy, 
i.e., I(W; M) = 0, the rate of the key, Rf., should at least be as large as the source data rate R s . This rate is also 
sufficient; in fact, letting R^ — R s , a simple linear code, W — M © K, achieves the capacity in this model. 

Secure communication over a wiretap channel was first defined by Wyner in [2]. In this problem, a transmitter 
attempts to send a message to the receiver over a broadcast channel described by p(y, z\x). The intended receiver 
observes output y of the channel, while an adversary observes output z. In [3], it was shown that the secrecy 
capacity, C s , of the wiretap channel subject to the weak secrecy constraint is equal to C s = max p ^ u x ^(I(U ; Y) — 
I(U; Z)). Subsequently it was shown in [4] that the secrecy capacity subject to the strong secrecy requirement, i.e., 
T(M; Z n ) < e instead of I(M;Z n ) < ne, is the same. 

The problem of secure communication over wiretap networks, i.e., the problem of secure network coding where 
an adversary observes an unknown subset of links chosen from a collection of such subsets, was proposed in [5]. 
In that conference paper and the subsequent journal paper [6], the authors considered a multicast problem where all 
messages and randomness are generated at a single source, and defined secure network coding capacity subject to 
zero-error communication and perfect secrecy. When all the links have unit capacity and the adversary can choose 
to access any subset of links of size at most r, it was shown that the secrecy capacity is equal to c s = n — r, where n 
denotes the max flow capacity from the source to all sinks. Moreover, linear codes are sufficient. A comprehensive 
review of the literature on linear network coding subject to security constraints is presented in [7]. 

The problem of general multi-source multi-destination secure network coding was studied in [8], which considered 
asymptotically zero error communication subject to weak secrecy constraint and presented inner and outer bounds 
on the set of achievable rates. The outer bound and the inner bound were presented in terms of "almost entropic 
pseudovariables" and random variables, respectively, each satisfying certain conditions. In [9] the authors present an 
outer bound in terms of entropic region on the network coding capacity region subject to weak secrecy requirement. 

This work extends the above results in a number of ways. A summary of our results is as follows: 

1) In the case of asymptotically zero probability of error, we prove that the network coding capacity regions 
subject to strong secrecy constraint and weak secrecy constraint are equal. This result is a generalization 
of [4], where the same result was proved for wiretap channels. The main ingredient of the proof in [4] is 
"extractor functions", a well-studied tool in computer science. We employ the same machinery here. The 
main difference between our work and [4] is that here we consider a general secure network coding problem 
with multiple sources and multiple sinks. 

2) We prove that in a general discrete memoryless network (DMN), where an adversary can choose to observe the 
output of an unknown subset of nodes selected from a known collection of such subsets, the capacity region 
subject to weak secrecy and strong secrecy are equal. DMNs are used to model general wireless networks. 
Hence, this result proves the equivalence of rate regions subject to strong and weak secrecy requirements in 
communication of independent sources over general noisy memoryless channels. 

3) We derive inner and outer bounds on the zero-error network coding capacity region subject to weak secrecy 
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constraint in terms of "entropic region". As will be explained later, in this case we consider variable-length 
coding across the channels. 

4) We derive inner and outer bounds on the network coding capacity region subject to weak secrecy constraint 
and asymptotically zero probability of decoding error in terms of "entropic region". Our outer bound is tighter 
than the bound derived in [9]. Our first result, i.e., equivalence of network coding capacity regions subject to 
weak and strong secrecy requirements, states that the derived bounds are also bounds on the secure network 
coding capacity region subject to strong secrecy with asymptotically zero probability of error. 
In [10], [11], the authors consider networks of wiretap channels. In the case where the eavesdropper has access 
only to the output of one channel, chosen from a known collection, they show that the weak secrecy capacity region 
is equal to the weak secrecy capacity region of another network derived by replacing each noisy wiretap channel by 
an equivalent noiseless model. Our result proves that both for the wired and wireless network the capacity region 
do not change by requiring strong secrecy. Therefore, it shows the equivalence established in [10], [11] also holds 
under strong secrecy condition. 

The organization of this paper is as follows. Section II defines the notations used throughout the paper, and presents 
a very brief overview of typical sequences and entropic region. Section III introduces the model and defines the 
capacity region of secure network coding problem under different notions of secrecy and error probability. Section 
II defines the notations used throughout the paper, and also reviews concepts of typical sequences and entropic 
region. In Section IV, we extend the result proved in [4] for wiretap channels to wiretap networks and show that 
in the case of asymptotically zero probability of error, the capacity region is equal under weak and strong secrecy 
requirements. Section V and VI present inner and outer bounds on the network coding capacity region under weak 
secrecy constraint, for zero error and asymptotically zero error, respectively. Finally, Section VII concludes the 
paper. 

II. Notation and definitions 

A. Notation 

For integers i < j, let [i : j] = {i, . . . , j}. Random variables are denoted by upper case letters such as X. For 
random variable X, let script letter X denote its alphabet set. Given vector {X\, . . . , X n ) and set a C {1, ... , n}, 
let X a = (Xi : i G a). For a set X, let 2 X denote the set of all subsets of X. For set A, A denotes its closure, 
and con(^4) denotes its convex closure, which is defined as the smallest closed and convex set containing A. 

For x, y G R™, x < y, if and only if, Xi < y^, for all % = 1, . . . ,n. For A C R™, let 

A(A) = {x G R" : x < y, for some y G A}. 

Also, define 

D{A) = {a*:a£ [0,l],XG-4}. 
For I C [1 : n] and A C R™, define the projection operation Proj(-) over the coordinated defined by 1 as 

Proj x (.4) ^{x i: xe4 
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where xx = (xi : i gl). 

The total variation distance between probability distributions p\ and p2 defined over set X is defined as dxv {Pi 1P2) — 
0.5 J2xex Ipi( x ) ~Pi{ x )\- Th e "min-entropy" of random variable X with pdf p(x) : X — > R + , H oa (X), is defined 
as 

ffooW - minlog - rT . 

B. Typical sequences 

For a sequence a;" € A"™, the empirical distribution of x n is defined as 

/ I TIN a : = x }\ 

tt{x\x ) = , 

n 

for all x £ X. For (x n ,y n ) £ X n x y, the joint empirical distribution of (x n ,y n ) is defined as 

n{x,v\* n ,V n )± l{i:{Xi,Vi) = {X ' y)}l , 

n 

for all (x, y) £ X xy. 

We adopt the definition of strongly typical sequences introduced in [12]. Given random variable X distributed 
as p(x), x £ X, and e £ (0, 1), the set of e-typical sequences of length n is defined as 

% {n) {X) 4 { x n : |7r(x|a; n )-p(x)| <£- P (i),Vie A}. 

Similarly, for random variables (X, Y) jointly distributed as p(x, y), 

% M (X,Y) 4 {(x n ,y n ) : \ir(x, y\x n , y n ) - p(x, y)\ <e-p(x,y),V (x,y) £ X x y}. 

Given discrete random variable X, 

(1 - e ) 2 «(i-«)*W < \% (n) (X)\ < 2 »(i+«WJO (1) 

for n large enough [13]. 

Consider discrete random variable X, and assume that Y = g(X), where g : X — s- y is a deterministic function. 
Lemma 1: If £ T e {n) (X), and y n = g(x n ), i.e., y< = then y n £ T e {n) (Y). 

Proof: For y £ y, define X y = {x £ X : g(x) = y}. Since g is a deterministic function, (X y : y £ y) forms 
a partition of X. For every y £ y, we have 

n-V(yk n ) -p(y)l = - E f^l 

= J e ^K) - E 

< E Hx\x n )-p(x)\ 

< e e -pO) 

= cp(»), (2) 
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which, by definition, shows that y n 6 T e (Y). ■ 
Lemma 1 simplifies our analysis in the next sections. Note that X in Lemma 1 can also be a vector, (Xi , . . . , X m ), 
where X\,..., X m are jointly distributed finite-alphabel random variables. In that case, letting Y = g(X\, . . . , X m ), 
by Lemma 1, if (xj, . . . , x") € 7^ n \Xi, . . . ,X m ) and ^ = g(xi,i, . . . , x m ,i), i = l,...,n, then y n G 7? (Y - ) 
as well. 

C. Entropic region 

In this section, following mainly the notations used in [14], we briefly review the definition of the entropy function 
of a number of random variables and the entropic region. 

Assume that (X±, . . . , X n ) are n jointly distributed finite-alphabet random variables. Define hGl 2 to denote 
the entropy function of (X\, . . . , X n ) defined as follows. For a C [1 : n], 

h a = H{X a ) = H{Xi : iea). 

For a = 0, h a = 0. Let H n denote the set of all possible 2™ dimensional vectors whose components are labeled 
by the 2" subsets of [1 : n]. A vector h £ T-L n is called entropic, if and only if h is equal to the entropy function 
of n jointly distrusted finite-alphabet random variables (Xi, . . . , X n ). The entropic region T* is defined as the set 
of all possible entropic vectors of n random variables, i.e., 

r* ={hg T-L n : h is entropic}. 

While r* is not in general a convex set, it is known that its closure T* is a convex cone [14]. Characterizing the 
entropic region is a very fundamental open problem in information theory. 

Entropy function is a submodular function, i.e., given jointly distributed discrete random variables X\, . . . ,X n , 
for any a.,/3 C [1 : n], 

H(X anf3 ) + H(X aU p) < H(X a ) + H(X ), 
Let r„ denote the subset of T~L n consisting of vectors in T~L n that satisfy the sub-modularity constraint, i.e., 
r„ = {h 6 H n : h a np + h aU < h a + hp,V a, ft C [1 : n]}. 
It is known that for n = 2, T 2 = T* and for n = 3, ^ T 3 , but Y% = T3. But for n > 3, it is known that 

K c r„ [14]. 

III. Problem statement 

Consider error-free communication network JV described by acyclic directed graph G = (V,£) such that V and 
£ denote the set of nodes and edges in G, respectively. Each node v £ V denotes a user in the network and each 
edge e = (ui,^) € £ represents an error-free bit pipe of finite capacity c e . For each node v £ V, let in(v) and 
out(u) denote the set of incoming and outgoing edges of node v. That is, m(v) = {(vi,v) : (v\,v) E £} and 
out(w) = {(v, V2) : (v,v 2 )e£}. 
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Let S C V and T C V denote the set of source nodes and sink nodes, respectively. Without loss of generality, 
we assume that: 

i) 5nr = 0. 

ii) Source nodes do not have incoming edges. That is, if s e S, 'm(s) = 0. 

iii) Terminal nodes do not have outgoing edges. That is, if t G T, out(t) = 0. 

iv) Only source nodes generate keys 1 . 

A secure network code of blocklength n operating on network Af is defined as follows. Each source s € S 
observes message M s and key K s uniformly distributed over 

M s = [1 : 2L™"™»J], 

and 

JC S — [1 : 2L" r *»J], 

respectively. Here, r TOa and rk s represent the information rate and the key rate of source s, respectively. 

Let W e e W e denote the message traversing edge e e £. While most of the network coding literature is 
dedicated to fixed-length coding across channels, in this paper, we consider both variable-length and fixed-length 
channel coding models. 

i) Fixed-length channel coding: In the fixed-length model, a bit pipe of capacity c e is defined to be an error-free 
point-to-point channel, which carries at most nc e bits in n transmissions. Therefore, in this case the rate of 
the code used on channel e is defined as 

r<f ^n-MoglWel, (3) 

or equivalently we can assume that 2 W e = [1 : 2 nr * f ]. 

ii) Variable-length channel coding: In the variable-length coding regime, for a blocklength of n, the number of 
bits sent over channel e with capacity c e is allowed to exceed nc e . Therefore, in the case of variable-length 

(v) 

coding, the rate of the code, r e , is measured as the average "expected" number of bits per channel use, or, 
more precisely, 

^n^H (W e ). (4) 

From the definition of r e v \ unlike the case of fixed-length coding, in this case n _1 log|W e | can be much 
larger than c e . 

As mentioned earlier, most of the literature on analyzing network coding capacity regions is dedicated to the 
case of asymptotically zero probability of error where the channel code used on each point-point channel is a 

'Note that this assumption is not restrictive. If node v £ V\(V U <S) desires to generate a key, we add a source node s' to 5 and a directed 
edge e' = (s' , v) to £ connecting s' to v, with large enough capacity c e /. Source s' does not have any message, i.e., M a i = 0, but it generates 
key K s i, and sends it directly to v' through e'. 

2 Throughout the paper the basis of logarithm is assumed to be 2. 
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fixed-length code. The reason in this paper we consider both fixed and variable length coding is that, here we focus 
on both asymptotically zero and perfectly zero probability of error. While fixed-length coding is a proper model 
for analyzing the capacity region of the former case, in the latter one, in order to avoid shrinking the achievable 
capacity region by a significant amount, we move to the variable-length coding paradigm. The advantage of this 
shift is that when using typical sets as the building blocks, variable-lengths codes allow us to once in a while send 
a non-typical sequence, without hurting the performance significantly. 

In [15], where the authors derive inner and outer bounds on the zero-error capacity region of acyclic networks 
(with no security constraint), there too the authors consider variable-length coding across the channels. However, 
at this point it is not clear to us, whether this shift of models is essential to the problem, or is a technical issue 
that can be fixed later. 

For each edge e = (»i,i)2)s^ the function rj e denotes the encoding operation performed by node v\ to generate 
the message sent over edge e. If e <G out(s), for some s £ S, then 

T] e : M s X JC S ->• W e , 

and 

W e =r) e (M s ,K s ). 

If e G out(u), where v G V\(S U T), then 

Tie ■ J] W e < -> We, 

e' £in(v) 

and W e = r]e(W e > : e! G in(u)). Each terminal node t G T reconstructs a subset /3(t) C S of source messages. For 
s G /3(t), let 7]t, s denote the decoding function applied at terminal node t for decoding source s. More precisely, 

Vt,s ■ We -> M a , 

eGin(t) 

and 

M s _> t = T)t,s(W e : e G in(i)), 

where M s ->t represents the reconstruction of message M s at node t. 

Let A s C 2 £ denote the set of security constraints described as follows. Each member a G -A s represents a subset 
of edges £. An eavesdropper can choose a set a G A s , and access the information transmitted on all the edges 
e E a. Our goal is to prevent the leakage of information to the eavesdropper such that asymptotically it does not 
get any meaningful information about the source messages. In the following, this notion is defined more precisely. 
1) Zero-error capacity region: Rate r = (r s : s G S) is said to be an achievable rate subject to weak secrecy 
with respect to the set A s C 2 £ at zero error rate, if for any e > 0, there exists a code of blocklength n large 
enough, message rates r„' = [rm] : s G S) and key rates = (r^ : s G S), such that 
i. For every s G S, 

17l 3 — S t. 
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ii. For every e £ £, 

r { : ] < c e . 

iii. For every a E A s , 

n^IiMs-Wa) < e, 

where M s = (M s : s € S) and W a = (W e : e £ a). 

iv. For every t € T, and s £ /3(i), 

P(A/ S ^ ^ M s ) = 0. 

Rate r = (r s : s £ 5) is said to be an achievable rate subject to strong secrecy with respect to the set 
A s C 2 £ at zero error rate, if it satisfies identical conditions as those required for weakly-secure achievable 
rates, except for condition (iii), where in this case we require 

I{M s ;W a ) < e, 

for every a G A s . 

Let IZ^ denote the set of all achievable weakly-secure rates with zero error. Similarly, let 72.^ denote the 
set of all achievable rates at zero error subject to strong security. 
2) Asymptotically zero-error capacity region: Rate r = (r s : s £ S) is said to be an achievable rate at 
asymptotically zero error subject to weak secrecy with respect to the set A s C 2 £ , if for any e > 0, 
there exists a code with blocklength n large enough with message rates r„' = (rt,' : s <G S) key rates 
r l n) = ( r i? ) ■ seS), such that 

i. For every s £ S, 

r (n) > r _ , 
' m s — 1 s c - 

ii. For every e £ £, 

i e — L e ■ 

iii. For every a £ _4 S , 

where M s = (M s : s £ S) and W Q = (W e : e £ a). 

iv. For every t £ T, and s £ /3(f), 

P(M s ^t ^ M s ) < e. 

Again, rate r = (r s : s £ 5) is said to be a an achievable rate subject to strong secrecy with respect to the set 
A s C 2 £ at asymptotically zero error rate, if all the above conditions hold, except for condition (iii), which 
is strengthened in this case as 

I{M s ;W a )<e, 

for every a £ „4 S - 
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Let 1Z\ and 1Z\ denote the set of all weakly-secure and strongly-secure achievable rates at asymptotically 
zero error, respectively. 

Remark 1: Note that we have defined the capacity constraint as < c e and < c e , in the case of zero error 
and asymptotically zero error, respectively. This is stronger than the condition usually considered in the network 
coding literature, where it is required that < c e + e or ri^ < c e + e, where e can be made arbitrarily small 
[14]. We believe that the restricter assumptions are more natural, because noiseless links of finite capacities are 
commonly used to model noisy channels of equal capacities [16], [17]. However, a noisy channel of capacity c e , at 
blocklength n, can carry at most nc e bits with arbitrarily small probability of error, which is equivalent to requiring 
ri"- 1 < c e and ri < c e . 

IV. Strong versus weak secrecy 

Consider the general discrete memoryless network (DMN) shown in Fig. 1. Let V denote the set of m nodes in 
the network. The channel is described by p(y rn \x m ), (x m , y m ) € X m x y m . Node i E V communicates with other 
nodes in the network through controlling input Xj of the channel and receiving output Yi. Let S C V denote the 
set of source nodes in the network, and let A denote the collection of potential sets of adversaries. Each a G A 
represents a subset of V that might be accessed by the adversary. The adversary chooses one and only one subset 
a £ A and observes the outputs of the nodes in a. Clearly, S n a = 0, for a € A. The goal is to minimize the 
data leakage to the adversary, while maximizing the throughput. 

The coding operations are performed as follows. Each node s E S observes message M s € [1 : 2 nVs ], and desires 
to communicate this message to a subset of nodes T> s C V\s, The messages are described to the destination nodes 
through a code of block length n. At time i £ [1 : n], node s£S, based on its received signals up to time i — 1 
and its own message M s generates its channel input X St i as X s ,i = f St t(M s , Y* -1 ), where 

f. ti : [1 : 2™-'] x yi 1 -> X s . 

At time i £ [1 : n], node v E V\S generates its channel input X v j as a function of its received signals as 

X v ,i = fvAY:- 1 ), where 

fv,i '■ yi 1 x v . 

Let M s _j. t denote the reconstruction of message M s at node t £T> S . If node t £ T> s is also a source node, i.e., 
t € S, then it reconstructs M s as a function of its received signals Y t n and its own message M t . In other words, 

M s ^t = g s ^ t (Y t n , M t ), where 

g 3 ^ t : y? x [1 : 2" 1 "'] -> [1 : 2 nr >}. 

If node t £ D s is not a source node, i.e., t ^ S, then it reconstructs M s only as a function of its received signals 
Y™. In other words, M s _+ t = g s ^ t (Y t n ), where 

g s ^ t : y? -> [1 : 2 nr ']. 
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Coding rate vector (r s : s £ S) is said to be achievable subject to "weak" security constraint, if for any e > 
and n large enough, there exists a code of blocklength n at message rates (ri '■ s £ S), such that the following 
two constraints are satisfied: 

i. Source rates: For s £ S, 

r { s n) > r s - e. 

ii. Reliable reconstructions: For every s £ S and t £ T> s , 

P(M s ^M s ^t) < e. 

iii. Secrecy: For every a € A, 

-I(Y^;M s )<e, 
n 

where M s = (M s : s G S) and Y£ = (F„ n : v G a). 
Coding rate vector (r s : s £ S) is said to be achievable subject to "strong" secrecy, if for any e > and n large 
enough, there exists a code with blocklength n and source rates (rs : s £ S), such that the following constraints 
are satisfied: 

i. Source rates: For s £ S, 

r ( s n) >r s -e. 

ii. Reliable reconstructions: For every s £ S and t £ T> s , 

P(A/ S ^ M 8 _, t ) < e. 

iii. Secrecy: For every a £ A, 

I(Y^M s )<e. 

Let K {s \p{y m \x m ),S,A) and K (w \p(y m \x m ) , S, A) denote the set of achievable rates on an m-node DMN 
described by p(y m \x m ), source nodes S and collection of sets of potential adversaries A, subject to strong and 
weak secrecy, respectively. 



December 18, 2012 



DRAFT 



11 



In this section we prove that for any general DMN, the set of achievable rates subject to weak secrecy is equal 
to the set of achievable rates subject to strong secrecy. This result is proved in [4] for wiretap channels. Here, we 
extend this result to general DMNs with multiple sources and multiple sinks. 

Theorem 1: For any set of sources S C [1 : m], and any collection of sets of nodes A C 2^ 1:m l that are observed 
by the adversary, 

K^(p(y m \x m ),S,A) = U^(p(y m \x m ),S,A). 

The proof of Theorem 1 is presented in Appendix A. As done in [4], we prove this result by employing a 
tool from theoretical computer science, namely, "extractor functions", to prove that, in secure network coding with 
asymptotically zero probability of error, the strong and weak secrecy regions coincide. Extractor functions are 
used in computer science to generate completely random bits with uniform distributions. An extractor function 
usually has two inputs, some "weakly" random bits (source bits), and some truly random bits (seed). Then, the 
extractor function deterministically maps the inputs to an output bit stream that has close to uniform distribution. 
In designing an extractor, one goal is to make the length of the seed as short as possible. Extractor functions have 
been extensively studied in computer science literature. (Refer to [18] and [19] and the references therein for more 
information on this subject.) 

Definition 1 ((5' ,e')-extractor [4]): Function E : {0, l}" 1 x {0, l}" 2 {0, l}" 3 is called (5', e')-extractor, if 
for any random variable T with T C {0, l}™ 1 and H X (T) > S'm, 

d TV ([V,E(T, V)],W)<e', 

where W and V are uniformly distributed over {0, 1}™ 2 +™ 3 , and{0, l}™ 2 , respectively. 

The above definition has a strong requirement that if we concatenate the output E(T, V) and the seed bits V the 
whole sequence has close to uniform distribution. In the literature, weaker notions, where one is only concerned 
with the distribution of the output alone, has been studied as well. However, since in this paper, we are going 
to apply extractor functions to network coding security applications, we use the stronger notion. The seed, in our 
applications, is a random bit sequence that is sent from the source to all interested destinations, and is potentially 
observed by all eavesdroppers. Hence, we need to measure security of the code conditioned on knowing the seed. 

The following lemma from [20] shows the existence of efficient extractor functions and gives bounds on parameters 
7i2 and ri3 in terms of m, 5' and e'. 

Lemma 2: Given m, < 5' < 1, and e' > 0, there exists a (£', e')-extractor E : {0, l}" 1 x {0, l}™ 2 -> {0, l}™ 3 , 
such that 

n 2 = 0((log(n 1 /e')) 2 log(yn 1 )) J 

and 

n 3 = S'ni-21og(l/e')-c, 

where c = O(l). 
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Clearly, for every set A s C 2 £ , TZ { Q w) C TZ { Q s) and Tl{ w) C 7^ s) . We prove that, in case of asymptotically zero 
probability of error, the other direction is true as well, i.e., 1Z\ — lZ e . A similar result is proved in [4] for 
wiretap channels. There, the authors show that moving from weak secrecy to strong secrecy does not change the 
secrecy capacity of wiretap channels. Here, we extend that result to wiretap networks. The main ingredient of our 
proof in the the following two lemmas from [4]. 

Lemma 3 (Lemma 9 in [4]): Let 6', 61,62 > 0. For any sufficiently large n\, there exists a function E : {0, l}" 1 x 
{0, l}™ 2 — > {0, l}™ 3 , where n 2 < &irii and n 3 > (6' — 62)1^1, such that for every random variable T with 
T C {0, l}" 1 and ffooCT) > S'm, 

H(E(T,V)\V) > n 3 -2-^- So , 

where 6q — o(l), and V is independent of T uniformly distributed on {0, l}™ 2 . 
The proof of Lemma 3, follows from Lemma 2. 

Lemma 4 (Lemma 10 in [4]): Let X and Y be two finite-alphabet random variables. For any A > 0, 

P (tfcopO - HcviXlY = y)< log |y| + A) > 1 - 2-\ (5) 

Proof: Since the proof of Lemma 4 is omitted in [4], for completeness, we present the proof here. Note that 
the probability in (5) is only in terms of p(y), not p(x). Let x m = argmax a ,p(a;), and x m (y) = argmax^, p(x\y). 
From these definitions, we can rewrite the complement of the event mentioned in (5) as follows 

P (HooiX) - H^XIY = y)> log |^| + A) 
= P(p(x m (Y)\Y) > p{x m )2 x \y\) . 



By Markov inequality, 



< 



(p{x m {Y)\Y) >p(x m )2 x \y\ 
E[p(x m (Y)\Y)} 

P {x m )2*\y\ 

Y, y ey P(y)p( x m(y)\y) 

p(x m )2 x \y\ 

Hyey P( x m{y))p{y\x m {y)) 
p(x m )2*\y\ 

P(x7n)J2yeyP(y\ X ™(y)) 

p(x m )2*\y\ 

P(xm) J2 v ey 1 

p{x m )2*\y\ 



< 



< 



< (6) 

which concludes the proof. ■ 
Note that a wiretap network, described in the previous section, is almost a special case of a DMN, when there is 
no noise in the system. The only difference between the two models is that in DMNs we assume that the adversary 
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has access to the outputs of some nodes in the network, while in wiretap networks, the eavesdropper listens to 
some links. However, the proof of Theorem 1 continues to hold for wiretap networks as well. In other words, 

Corollary 1: For any wiretap network Af described by graph G = (V,£), set of sources S, set of terminals T, 
(/3(t) : t <G T), and collection of potential sets of links A s C 2 £ , 

V. Capacity region: zero-error coding 

In this section we derive inner and outer bounds on the secure network coding capacity region subject to weak 
secrecy constraint and zero probability of error. As a reminder, in the case of zero-error communication, we consider 
variable-length coding across the links. 

Consider a set of finite-alphabet random variables ((U ms , Uk B ) s eS> {U e )eeS ) corresponding to the source mes- 
sages, source keys and codewords sent over the edges. Define N = 2\S\ + \£\ to denote the total number of such 
random variables in the network. As defined earlier, T* N denotes the entropic region defined by all possible set of 

finite-alphabet random variables. 

Define sets Fi, . . . ,Fq as follows: 

ri 4 {h G H N : h MsUKs = ^(/i ms + h ka )}, (7) 

r 2 = {h e Hn ■ ^m s ,fc a ,out( s ) = h ms ^ kg , v s e S}, (8) 

r 3 = {h G U N ■ ftin(t,)Uout(ti) = h in(v), V V G V\S U T}, (9) 

r 4 = {h e U N ■ h mpWjin (t) = ftin(t)j V* g T}, (10) 

r 5 '{he%: h e <c e , Vee£}, (11) 

r 6 = {h G %n ■ h ms ,a = h ms + h a , Va G A}- (12) 

For /? C [1 : 6], let 

Also, for notational simplicity, sometimes instead of IV j\, we write r,j. 

Define the projection operator Proj iS (-) over the set "Hjv as follows: for any vector h G %n, f = Proj 5 (h) G E,' 5 ' 
and f s = h s , for all s G 5. In other words, Proj 5 (-) projects a vector in Hn onto the coordinates corresponding 
to the source messages. 

Theorem 2 (Inner bound): Define 



TZ 0ti = A(Proj 5 (con(r^ n Pi234 6 ) H r 5 )). 



Then, TZ ,i C 



Theorem 3 ( Outer bound): Define 

7e , o = A(Proj 5 (con(r^ n ri 234 ) n r 56 )). 
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Then, K ( W > C Tl 0iO . 

Before proving Theorem 2, note that since Ti2346 is a linear subspace of T-Ln, straightforward extension of 
Lemma 21.8 in [14] yields: 
Lemma 5: 

cm{v* N n r 12346 ) = d(t* n n r 12346 ) 

This result is used in the proof of the theorem. 

Proof of Theorem 2: If r e 7\L tu ' ) , then by our definition of achievability, any rate vector r' < r is also 
achievable. Hence, to prove the theorem, it is enough to show that 1Z' i = Proj 5 (con(r^ n T12346) H T5) CTZ. 

Let r e IZ'i. By the definition of TZ' Qi and Lemma 5, there exists sequences h' fc ' e n ri 2 3 4 6, a k € (0, 1], and 
e/c € (0, 1] such that, for any seS, 

afc&<£ > r s - e fe! (13) 

for each edge e £ £, 

a fc /i e fc) < c e + cfc, (14) 

and e k — > 0, as k grows to infinity. 

Based on the sequence of entropic vectors h^ k \ we build a sequence of weakly secure network codes with zero 
probability of error that asymptotically achieves rate r. 

Since h' fe ' £ T%- (1 Ti2346, there exists a set of finite-alphabet random variables random variables, {U ms , U ks ■ 
s S <S} U {U e : e <E £}, which satisfy the following: 

i. Random variables (U„ ls , U ks : s <G S) are all independent. That is, 

H{U ms ,U ks :seS) = Y J H{U ms )+Y J H{U kt ). (15) 

ii. For each outgoing edge e e out(s) of a source node s e S, since fr ms ,fc s ,out(s) = h m „,k s , there exists a 
deterministic function r) e , 

rj e : U ms x U ks -> W e , (16) 

SUCh that f/ e = 11e(U7n s ,U ks )- 

iii. Similarly, for each edge e = (ui,^) with i>i £ S, since h- m r Vl \ out r Vl } = /ii n ( Vl ), there exists a deterministic 
function ?y e , 

?7e: J] U e ,^U e , (17) 

e'Gin(ui) 

such that U e = r] e (U e > : e' £ in^i)). 

iv. Corresponding to each sink node t € T and source node s E /3(t), there exists a decoding function rjt, s , 

Vt,s- J] U e ^U mBl (18) 

egin(i) 

such that U ms = rj t . s {U e : e £ in(i)). 
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A. Random code construction 

For each source s, consider the sets of e-typical sequences T} nt \u ms ) and 7~e\Uk s ) and let 

Ms A Te (n t )( f/m J ) 

and 

Moreover, define 

\M.\±2 nr %, 

and 



where n denotes the blocklength of the code and will be specified later. 

For edge e € £, define 
is a typical sequence, i.e., 



For edge e € £, define random variable 1^'^ as an indicator function of whether the message traversing edge e 



The blocklength n is defined as 



where 



I {nt) = 1 , i 



n t (l + <?) 
afe 



(19) 



From this definition, for fixed e^, choosing nt large enough and e small enough, <5 can be made arbitrarily small. 

After building the message and key codebooks in this manner, the encoding operations are performed as follows. 
Each source s e S chooses message M s and key K s uniformly at random from sets Ai s and JC S , respectively. 
Corresponding to each edge e <G out(s), by applying the function rj e symbol-by-symbol to (U^ , U^), the source 
constructs codeword W e = U™*. In other words, for e <G out(s), and i = 1, . . . ,n t , 

U e ,i = r) e (U ms! i, U ks ,i). (21) 

At node v € V\(6> U T), the codeword W e sent over edge e £ out(w) is constructed from (W e >) e i£i n ( v ) = 
(t^^e'eintti) by applying the function r\ e symbol-by-symbol. That is, for i E [1 : n t ], 

U e ,i = Ve{U e >,i : e' e in(u)). (22) 

Finally, sink node t e T reconstructs the message at source s <G f3(t), M s ^t = , as a function of 

(W / e ) eG in(t) = (^"OeeinW- such that > for i = 1, . . . , n t , 

C/m s ,i = Wt,s(Ue,i ■ e e in(t)). 
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B. Performance evaluation 

1) Source rates: From (1), for nt large enough, 

(1 - e )2 n ^-^l < \% {nt \U ms )\ < 2 n ^ 1+ ^l, (23) 

where by our definition h^] = H(U m J. Hence, by (13) and (19), 

< k) = \og\% {nt \u m3 )\ 
n 

n n 

> Mi-e) , u afclog(l-e) (24) 

- n t (l + ( 5) + a fe lrs £fej + n t (l + 5)+ afc - U4) 
Choosing e k small enough, and then e and n t appropriately, we can make the right hand side of (24) arbitrarily 
close to r s , for all s € S. 

2) Channels capacity constraints: As mentioned earlier, in the case of zero-error decoding, we consider variable- 
length channel coding. Hence, to make sure that the capacity constraints are satisfied, we need to prove that 
H(W e ) < nc e , for all e £ £. To prove this, note that 

H{W e ) < H(W e ,Ie) 

= H(U?\I e ) 

= H(I e ) + H(U:*\I e ) 

< l+#(t/ e nt l/ e = l)p(/ e = l) 

+ H(u:*\I e = 0)P(I e =0) 

< l + log|r 6 (nt) (t/ e )| +H(U?\I e = 0)P(/ e = 0), (25) 
where, for simplifying the notation, we have replaced li™ 1 - 1 in (25) by I e . Again, for n* large enough, 

(1 - e )2 n *( 1 - £ ) ff ( c/ <=) < \T e (nt) {U^)\ < 2"*( 1+e W 7 =). (26) 
Combining (55), (19), (20), (25) and (26) yields 

H(W e ) < 1 + n t (l + e)H{U e ) + n t log \U e \ P(/ e = 0) 

< 1 + ^((1 + e)h^ + log |Z4| P(J e - 0)) 

< i + ^L((i + e )(*±i*) + bg |Z4| P(J e = 0)) 

1 + d a k 

e k . , a fe log|W e |P(/ e = 0) 



^ 1+ if^( (1 + e)(1 + f ) + 

'1 + 0.5(5 



1 + i 

< nc e , (27) 



where the last step holds only for n large enough. 
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3) Decoding error probability: We prove that the decoding error probability of the described code, i.e., 

Pi") 4 P(M 5 _> t ^ M s , for some t e T, s£ 0(t)), 

is zero. To prove this, we show that P(M s _ > t M s ) = 0, for any t e T and s g /3(t). 

As mentioned earlier, since h' fe ) G T4, the jointly distributed random variables {U e )ees and (U ms ,Uk B ) s eS 
satisfy 

C/m = i7t,g(^e = e g in(i)), 

for all t € T and s g where 7/t, s (-) is a deterministic function. This implies that for any u TOs G W TOs , t E T 
and u in(t) g rieein(t) We ' 

P(C/ ms = u m J[/ in ( t ) = u in(t) ) = 1, (28) 

if u ms — T?t, s (Min(i))> an d zero otherwise. Assume that for g £4 and Ui n (t) g rieein(i)^e are such that 
P(Uk s = Um B | ^in(t) — u in(t)) = 0. Then, it follows that 

(ti msx{s} ,« fcs )6 

n n u h 

= P( u ™ S \{ s }i u ks\ u in(t))p(u ms \u in (t),U msx{s} ,Uk s ). (29) 

Therefore, from (29), for any u msUs} g I1 S 'gs\{s}^' and e IL' e s^*v such that p(w„ isUs} ,M fes |u in(t) ) 7^ 0, 
or equivalently p(u msx{s}7 u ks \u in{t) ) ^ 0, 

P(Wrn s |«in(t) , «m 5U , } , Ufcs ) = °- ( 30 ) 

Equation (30) implies that for any u„ lsx{s} , Uk s and u in ^ such that there exists u m , g W m ,, for which applying 
encoding operations rj e (-) to input vectors u ms , Uk s results in the input edges of sink node t taking values iti n ( t ), 
we have 

U ms = Vt,s(u in (t))- 

Clearly, by the union bound, 

P0Z ^ ) < E P (U ms ,i + U msii ). (31) 

i=l 

Hence to show that P(£/£* ^ U%J = 0, it suffices to show that P(U m3 ,i ^ U m . s ^) = 0, for all i = 1, . . . , n t . But, 
the above argument guarantees that 

P(U m „i + U ms J = 0, 

for all £ = 1, ... ,n. 
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4) Security guarantee: We prove that for any a G A s 



±I(M s] W a ) = h{U% s -U2 t ) 

can be made arbitrarily small. 

For any a g A s and u^ s <G ILes -^ s ' we h ave 

nt 

= E PKsK£) II Pu a \u kS:ms {u a ,i\u ksti ,u ms ,i), (32) 

where the last step follows from our symbol-by-symbol coding strategy described by (21) and (22). 
Let 

fcs — ]^[ K-s- 

At source node s € S, the message and the key are drawn from a uniform distribution from AA S and JC S , respectively. 
Hence, for £ K,$, 

-r-r -r-r < fc ) ~~ n 2-, r l 

For u£ e n. 6 s^\/C 5 , 

For u£< e K„ since iC s = % (nt) {U ks ), 

2 -n t h^(l+e) < p ^ (u n t) < 2 -n t fc« (1-e) > (33) 

where pr/ fes = nXiPtf*, ( u k s ,i)- ° n the otner nand ' 



Combining (1), (33) and (34) yields 



2- 2n ^ PUks {nil) < PKs {uZ) < {^-)2 2n ^ PUks (u£), (35) 
for any u?' G /C s . For u^ 4 <^ /C s , Pjc s (Wfc') = 0, and hence 

0<PK>£)<P£/ fc >2). (36) 
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Therefore, by inserting (35), and (36) in (32), it follows that 

p(i7Z* = «2TO S = «2J 

= E P^siKl) II Pu a \U hs , ma (Ua,i\Uk a ,i,U ms ,i) 



1 lcl 2n t e(E 



< E (— ~) lSl2 s€S ]\PU a \U ks , ms (Uoi,i\ u k S ,i,Um s ,i)PU hs (Uk s ,i) 

ew, nt 6 »=i 

I 2n t e( J2 h(k) ) Ut 

i=l «fc s i &t ks s£S 

where (a) follows from the fact that Pk s { u T s ) = °' for u fcs G ^fcsV^S- 

By assumption, h'^ € Tg, and therefore, I(U a ; U ms ) = 0. This implies that, for any u a G W Q and w ms € W m5 , 
p(u a \u ms ) =p(u a ). Hence, 

X! Pfa|yfc 5 ,m s ( U «.iKs.i> W m 5 ,i) n^.^'.*) = E PU a ,U ks \U ms ( u a,i, u ks,i\ u ™ s ,i) 

= Pl/««K,i)' ( 38 ) 

Combining (37) and (38), it follows that 

p(c^=«s t m^ = «srj<(— )' s i2 n^- 

= I5| 2 •« p ffa «), (39) 

1 — e 

or equivalently, 

-ilogP(^' = <'|[/«* s = <C 5 ) > -Ilog^«) + |5|l0g(1 ~ e) - 2 e (^)(^^). (40) 

Multiplying both sides of (40) by P(U^* S = u^ s ,U 7 ^* = it™*) and taking the sum over all w" f e W™' and 

<J S GZCS,, we get 

>(^i^ s )>>(^) + E pre* = <*) log p( f ' = f } + 151 lo f " e) - *£)■ 

(41) 

or, rearranging the terms, 

1 -WS>;U Z)+ £ P(ig* = <*) log P( f = !f } < Jgljg^ + fcfflg fcff ). (42) 

The second term on the left hand side of (42) is the Kullback Leibler distance between P(J7„* = u™* ) and pu a («J ) 
and hence is positive. Therefore, 
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But letting n grow to infinity and choosing e small enough, we can make the right hand side of (43) arbitrarily 
small, for every a £ A s - 

■ 

Proof of Theorem 3: Let r £ be an achievable rate. We prove that r £ lZo, - 
Since r £ Hq"\ there exists a family of weakly secure network codes of growing blocklength m, source rates 
Yms and key rates rjj.™ , and a sequence (eg), I > 1, which monotonically converges to zero, such that, for any 
source s £ S, 

r^'J >r s ~ et, (44) 

and for any set of edges a £ A s , 

—I(M s ;W a )<e e . (45) 

m 

Let (M ( s e \K { / } ) seS and (W^) ee£ denote the source messages, keys, and edge messages of the code of blocklength 
ri£, respectively. 

Corresponding to each I £ M, define N random variables (im„ )ses, )ses an d (^e )ee£ as follows. For 

s £ 5, 

^=Mf) (46) 

and 

Yg>=KV>, (47) 

and for e £ £, 

yW=W ( f ) . (48) 

Let h' £ ' denote the entropy function of the defined N random variables. From the independence of the source 
messages and keys, it follows that 

Hence, £ Ti. Consider message We transmitted on edge e = (i>i,i>2) £ £■ If v\ is a source node, i.e., 
Vi £ S, then We is a function of source message Ms and key Ki e \ In other words, H (wj^ |M S , K^) = 0, 
or equivalently H (Afj , K^^wjP) = H (Ms e \ ) . Therefore, h.^ £ T2- If v\ is not a source message, then 
is a function of the messages traversing the incoming edges of node vi, and hence h^' £ as well. 
The code is assumed to have zero probability of error. Therefore, for each sink node t £ T, source messages in 
Pit) are a deterministic function of the incoming message of node t. That is, for t £ T, 

HiM^ t) \W^\ t) ) = HiiMi% em \(W^) e&n{t) ) = 0. 
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Hence, e T 4 as well. Clearly, is an entropic vector, i.e., h^' £ T* N . Combining all these results, it follows 
that 

hW er;n r 1234 . 

Moreover, € T* N n Ti 234 . Therefore, since con(T*y n Ti 234 ) is a convex set, 

(1 - nJ^O + n^h® = n^h® £ con(T* N n r 1234 ). 

As mentioned earlier, at blocklength n^, the message transmitted on edge e, We, should satisfy H(We^) < ri£C e . 
Therefore, n^hW € Ts, and overall, 

nj l h® g con(r^ n r 1234 ) n r 5 . (49) 

Given the sequence, £=1,2,..., define a sequence of sets as 

if > = {he%: /i ms + K - h ms , a < et, Va e As}. (50) 
Combining (45) and (49), it follows that 

n^hW e con(r^ n r 1234 ) n r 5 n if >. (51) 

To finish the proof, define 

ftW = A(Proj s (con(r^ n r 1234 ) n r 5 n rf )). (52) 

By (44), n^hi^ = rq l H{Mi l) ) > r s - e e for all s £ S. Combing this with (71), and (52), yields 

Since eg is monotonically decreasing to zero, and since construction of H$p involves applying the A( ) operation, 



we have 

oo 

i'=i 

On the other hand, for any I > 1, 

oo 

n = **• 

Therefore, r — eg £ TZ , for I > 1. But, 7Z is a closed set. Therefore, r £ TZ as well. This concludes the proof. 

■ 

VI. Capacity region: asymptotically zero-error coding 

In this section we consider the problem of asymptotically-zero-error network coding subject to weakly secure 
network coding constraint, and derive inner and outer bounds on the capacity region. 
Theorem 4 (Inner bound): Define 

n e ,i = A(Proj 5 (con(r^ n r 1236 ) n r 45 )). 
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Then, 

Theorem 5 ( Outer bound): Define 

ii e , = A(Proj 5 (con(r^ n r 123 ) n r 456 )). 

Then, 

n e c n e , . 

Before proving Theorem 4, note that since Ti236 like Ti2346 is a linear subspace of Hn, similar to Lemma 5, 
we have: 
Lemma 6: 



con(r^ n r 1236 ) = d(t* n n r 1236 ) 

Proof of Theorem 4: Similar to the proof of Theorem 4, by Lemma 6, it suffices to show that lZ' e i = 



Proi s (D(r* N n r 1236 ) n r 45 ) c n e . 

For any r G 7V e it by definition of 1Z' C js there exists sequences h( fc ) G T* N D Ti23456, cik G (0, 1], and e (0, 1], 
k = 1,2,..., such that, for any s £ 5, 

a*fcS2 > r. - e fc) ( 53 > 

for each edge e G 5, 

a fc ^ fc) <c e + e fc , (54) 

for each terminal t &T, 

h [k) . ... - h {k) M < e k , (55) 

m 3(t) ,m(t) in(t) — «' v > 

and e^. — > 0, as k grows to infinity. 

Similar to the proof of Theorem 2, we build a sequence of weakly secure network codes with asymptotically 
zero probability of error based on the sequence of entropic vectors h( fe ). 

Since h' fe ^ G T* N n Ti236, there exists a set of finite-alphabet random variables random variables, {U mg , Uk 3 ■ 
s G S} U {U e : e G £}, which satisfy conditions (i), (ii) and (iii) corresponding to equations (15), (16) and (17), 
respectively, which are listed in the proof of Theorem 2. The only difference is that since is no longer in Ta, 
the condition stated in (iv), which requires reconstruction of source variables of interest at each sink does not hold 
in this case. 
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A. Random code construction 

Consider building the source and key codebooks according to the construction described in the proof of Theorem 



2, i.e., for s G S, let M s = % {nt] \U m .), and K s = % {nt) {U ks ), where \M S \ = 2 nr S and \JC S \ = 2" r ** . As 



before, n denotes the code's blocklength. 

Source s G S picks message M s and key K s uniformly at random from Ai s and JC S , respectively. Edge 
e G out(s), applies the function r) e , which is specified from by the fact that hS k ' G T2, symbol-by-symbol to 
(L^* , ')> tne source builds codeword W e = f7™*. In other words, for e G out(s), and i G [1 : n t ], 



After building the message and key codebooks in this manner, the encoding operations are performed as follows. 
Each source s E S chooses message M s and key K s uniformly at random from sets M. s and JC S , respectively. 
Edge e G out(s) applies function r) e symbol-by-symbol to (M S ,K S ) = (U£f >U^) and generates {/"', i.e., 
U e ,i = Ve(U ms .i,Uk Sy i), for i € [1 : n t }. Unlike the case of variable length coding, where always W e is equal to 
t/"S in this case, if (U% s ,U£*) G % {nt) (U m . s ,U ks ), then W e = [/"*; Otherwise, W e = 0. Note that by Lemma 1, 
if (U% e ,U%) G 7l nt) (U ms ,U ks ), then G T e (nt) (t/ e ) as well. 

Similarly node v £ V\(SUT) constructs W e , e G out(w), as a function of (VFe' : e' G in(w)) as follows. If there 
exists an incoming message in the received messages of node v, which is equal to 0, then let W e = 0. Otherwise, 
node v constructs t/" f , such that U e<i = ri e (U e > ti : e' G in(w)), i G [1 : n t ]. If U" n ^ G Tt nt \u in ( v) ), then 
VF e = [/"*; Otherwise, W e = 0. Again, by Lemma 1, if U£, v) G T e ( " f) (C/ in(l ,)) then [/ e " f G T e ( " f) (C/ e ) as well. 

Finally, sink node t G T reconstructs the message M s , ,s G as a function of (W e : e G in(t)). Let M s ^>t 
denote the reconstruction of message M s at t. If at least one of the incoming messages of node v is 0, then it lets 
M s ^ft equal to an arbitrary fixed message from Ai s . Otherwise, it looks for [/ T " f €z A4 S such that 



and lets M s _> t — . If there is no such message, again it lets M s ^ t equal to an arbitrary predetermined message 
from M s . 

Similar to (19), blocklength n is defined as 



U e ,i = f]e(U mst i,U keii ). 



(56) 



n = 



A \n t {l + 5) 



(57) 



where 




(58) 



Again, for fixed e k , choosing n t large enough and e small enough, 5 can be made arbitrarily small. 
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B. Performance evaluation 

1) Source rates: Since M s = Te (U ms ), for n t large enough, from (1) it follows that 



r 



{k) _ \og\% {nt) {U ms )\ 



n 



Ttf (1 - e) q fc log(l-e) 

> , « , r s - e fc + . (59) 

n t {l + S) + a k n t (l + S)+a k 

Again tuning the parameters e k , e and n t appropriately, we can make the right hand side of (59) arbitrarily close 

to r s . 

2) Channel capacity constraints: In this case, we have assumed fixed length coding. Hence, to prove that channel 
capacity constraints are satisfied, it suffices to show that nT 1 log |W e | < nc e . But, W e = 7e (U e )[j{0}. Therefore, 

n-MoglWel =n- 1 log(|T e ( " t) (^)l + l) 

< n-Hog^Xu^ + n-^T^Xu^- 1 

< ^i + £) /l ( fc)+e 
~ 1 + 5 

< (T^)(ce + efe) + e 

(b) 

< Ce, (60) 

where (a) follows from log(l + x) < x, and (b) follows from (58). 

3) Security guarantee: We prove that, for any a £ A s , n~ 1 I(Ms;W a ) can be made arbitrarily small, as 
blocklength grows to infinity. Note that the difference between the coding performed on the edges in this case and 
the case studied in the proof of Theorem 2 is that, here, codeword W e sent over edge e can sometimes be empty . 
This happens when either one of the incoming messages to the tail of e is empty, or ^™( tai i( e )) is n °t typical. In 
fact the set of messages carried by the edges in this case can be viewed as the previous set of messages corrupted 
by an erasure channel with memory; If an input message of a node is empty, then all the messages carried by its 
descendants are zero as well. 

Let 

I e — liv^o, 

i.e., I e is an indicator function that shows whether the messages carried by edge e is empty or not. Note that W e 
is a function of ([/"*, I e )' W e — U™< , if I e = 1, and W e = 0, otherwise. Therefore, 

n- l I{Ms\W a ) < n- l I{M s] U^\l a ) 

< n^IiMsiU^+n-HiMs-JalU^) 

<n- 1 /(M 5 ;C/" t )+^ 1 log|«l- (61) 

In the proof of Theorem 2, we showed that n~ 1 I(Ms] U£*) can be made arbitrarily small. Since max Qe _4 s \a\ is 
fixed and does not grow with n, it follows that we can make n~ 1 I(Ms; W a ) arbitrarily small for any a G A s . 
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4) Probability of error: Proving that the probability of error converges to zero as n grows to infinity is involved, 
but follows from the straightforward extension of the analysis presented in [25], and we skip that here. 

■ 

Proof of Theorem 5: 
Let r £ lZ e be an achievable rate vector. We show that r G 7?. e o . 

Since r G lZ e , there exists a family of weakly secure network codes of increasing blocklength n,( with message 
rates r^' and key rates rj^ , and a sequence (eg : £ = 1, 2, . . .), monotonically converging to zero, such that 

r^'J >r s -6i, (62) 



for all s e S, 

—I(M s ;W a ) < et, (63) 

m 

for all a E A s , and 

P(M a ->i ^ M s , for some t G T, se f3(t)) < e e . (64) 

For blocklength nt, let (M s )seS and (We )eg£ denote its set of source messages, keys, and edge mes- 

sages, respectively. Also, corresponding to each £, define N random variables (Ym]) s eS, 0^ )«es an d (^e )ee£ 
as (46), (47), and (48), and similarly let h^' denote the entropy function of these TV random variables. By the same 
arguments presented in the proof of Theorem 3, 

«7 1 hW e cos(r^ n r 123 ). 

In the fixed-length channel coding paradigm, the Message We transmitted on edge e satisfies log \ wlf > \ < n,£C e . 
Therefore, H(wf ] ) = log \wf ] \ < n e c e . Hence, n^h^ € T 5 , and 

nj l h^ g con(r^ n r 1234 ) n r 5 . (65) 

For every sink node t 6 T, combining Fano's inequality and (64) yields 

H W$ t) \W«l t) ) < 1 + n e ( £ r^)) P(J(3u t ^ M s , for some a € /3(f)) 

<l + n,( r^)e t , 

sG/3(t) 

or dividing both sides by ng 

n^H{Mfl t) \W^ (t) ) < nj 1 + £ r^e e . (66) 

For any source s G 5, if > £ e iout(s) Ce ' men me probability of error gets arbitrarily close to one, for 
n large enough. Hence, without loss of generality, we assume that, the rate of source s G S does not exceed its 
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outgoing edges sum capacity. Then, 

E ^<E^ f) 

sG/3(t) seS 

^E E * 

sSiS eSout(s) 

= c M . (67) 

Combining (66) and (67), it follows that 

= h mi3(t)Mt) - h in{t) 

<rq x + c M U, (68) 

for every t E T. 

Given the sequence, (e^ : I = 1, 2, . . .), define the two sequences of sets as 

= {h e H N ■ h mmtin ( t ) - h in ( t ) < nj 1 + c M Q, V t € T}, (69) 

and 

rf } ^{hen N : h ms + K- h ms . a < {(l V«eA}. (70) 

Note that n^h^ € n T^. Therefore, from (65), it follows that 

nj 1 }^ e con(r^ n r 123 ) n rf n r 5 n if 5 . (71) 

The rest of the proof can be done similar to the last steps of the proof of Theorem 3. Let 

4 A(Proj 5 (con(r^ n r 123 ) n rf n r 5 n if >)). (72) 

By (62), n^li-p > r s — e/ for all s£5. Combining this with (71) and (72), yields 
By the same argument we had before, 

oo 

On the other hand, for any I > 1, 

oo 

Therefore, r — S 7\L , for £ > 1. Since 7£. Q is a closed set, r G 7\L as well. 
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VII. Conclusion 

In this paper, we considered the problem of multi-source multi-sink communication over wiretap networks. 
We studied both zero and asymptotically zero probability of reconstruction error, and proved that in the case 
of asymptotically zero error, the capacity region subject to weak secrecy requirement is equal to the capacity 
region subject to strong secrecy requirement. In fact we proved this equivalence for general multi-source multi- 
destination wireless networks modeled by discrete memoryless channels. This result implys that equivalence models 
derived previously for weak secrecy [10], [11] also hold under strong secrecy constraint. Both for zero-error and 
asymptotically zero-error communication, we derived inner and outer bounds on the capacity region subject to weak 
secrecy constraint in terms of the intersection of the entropic region and some hyperplanes defined by the network's 
constraints. 

APPENDIX A: Proof of Theorem 1 

We start by a weakly secure code and apply it multiple times. Then we use extractor functions to build a strongly 
secure code. The difference with [4] is that here we have multiple sources and destinations and the communication 
medium is a noiseless network of bit pipes. 

Clearly, Tl^ w \p(y m \x m ),S,A) C TZ^(p(y m \x m ),S,A). We only need to prove that 

TZ^(p(y m \x m ),S,A) C TZ^(p(y m \x m ),S,A). 

To achieve this goal, we start by a weakly secure code, and apply the same code L times. Then, employing extractor 
functions to the concatenation of the messages, we construct a strongly secure code. 

Let r = (r s : s G S) G (p(y m \x m ) , S , A) . By definition, for any e > and n large enough, there exists 
a weakly secure code of blocklength n and source coding rates (r a : s G S), such that r a > r a — e, for every 
s G S, P{M S ^ M a -, t ) < e, for s G S and t G V s , and n -1 /^™; Ms) < e, for all a G A. 

Consider applying this code L times. For s G S, let M s> i and M s _j. t ^ denote the message transmitted by source 
s and its reconstruction at node t G T> s , respectively, at session I G [1 : L}. By the union bound, ¥(M s L _^ t ^ 
Mg) < eL. Consider modeling the problem as a problem of source coding with side information. Source s has 
access to i.i.d. samples of M s and terminal t observes correlated side information M s ^ t . By the Fano's inequality 
[21], H(M s \M s ^ t ) < nr s e + 1. Hence, by the Slepian-Wolf coding theorem [22], if L is large enough, for any 
ei > 0, source s by sending LH(M s \M s ^ t ) < L(nri n ^e + 1) extra bits to all terminal in T a — {t '■ s G T> a }, can 
ensure that 

P(M^ t ^M a L )< ei , 

where M^ t denotes the reconstruction of Mf at terminal f as a function of M^ t and the extra information 
received from the Slepian-Wolf coding sessions. Let O s G O s denote the message sent from source s to all 
terminals t such that s G /?(*). Note that log \O a \ < i(nri n) e + 1). 
For £2 > 0, define event B as 

B A {(M5 , Y™ L ) G ^'(Ms.y;) : for all a G A}. 
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By the Hoeffding's inequality [23], for (m s ,yZ) € I\ seS M s x EUc^ 

P (\n(m s ,y2\M£, Yt) - p(m s , y n a )\ < e 2 p(m s ,y2)) 

> i _ 2-' 2Le 2P( m s >s/2)+ 1 . (A-l) 

Combining (A-l) with the union bound yields 

p(s c ) < 2 _2Le 2P( m S'ys)+ i 

n x n y? 

2 ses \\yi\ n \2- 2Le * +\ 

where p* = miriQ.g^ min( mSj!/ ») p(jns, w a ). Note that p* > and does not depend on L. Hence, 

P{B C ) < 2-i L+r \ (A-2) 

where 7 = 2e%p*, p* — min a6 ^ min( mSjJ/ ») p(ms, Va) > 0> an d 1/ -> as L -> 00. 

Since the original code is assumed to be weakly secure, for any a £ A, I(Ms;Y™) < en. Therefore, for any 
s € S, H(M S \Y™, Ms\ s ) > nr^ — ne, which due to the independence of the messages yields 

H(M a \YZ,Ms\ a )>nr<p-ne. 

Also, for any a € A, G \[ iea y? L , if (m%,y% L ) G T 6 ( 2 L) (M 5 , F"), then 

Therefore, 

H^M^M^ = m L SXs , Y™ L = y n a L ,B) 

> (1 - e 2 )LH(M s \M S \ s ,Y2) 

> (1 - e 2 )In(rW - e). (A-3) 

The error correcting messages O5 = (O s :s€5) are sent to the desired users without additional coding to prevent 
information leakage to the adversary. The adversary observes random variables correlated by Os through outputs Y a . 
By the data processing inequality, the worst case performance from the vewipoint of security is when the adversary 
observes the we messages Os = (O s : s G <S) instead of their noisy version. For (m s \ g) y™ L 
by Lemma 4, for any A > 0, with probability exceeding 1 — 2~ A , 

H^M^M^ = m£ x „ Y£ L = 2/™ L , O s =o s ,B) 

> (l- e2 )L„( r W- e )-^l g|a|-A 

> (1 - e 2 )Ln(r< n > - e) - L(n £ r^e + |5|) - A 

= Lnr(")(l-e 3 ), (A-4) 
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where e 3 = 1 — (1 — e 2 )(l — e/j"s ) — (e^ s , r^f* — n x )/rs — X/(Lnrs), and can be made arbitrarily small 
by choosing L and n large enough and e and ei appropriately small. Let A = n+ [logL], and define event H s as 
the event (A-4) holds. Note that P(H S ) > 1 - 2- n L~ 1 . 

As mentioned before, to convert the weakly secure code into a strongly secure one, we apply Lemma 3. Let V s 
be an independent random variable generated at source s £ S, such that V s = {0, l}" 2 s . By Lemma 3 and (A-4), 
for each source seS and any given 61,82 > 0, there exists an extractor function E s : {0, l} Lnr< i 1 x {0, l}" s2 — > 
{0, l}™- 3 , such that n^ 2 < S^nr^K n s , 3 > (1 - e 3 - 5 2 )Lnr [ s n) , 

H(E S (M^V S )\Y: L = y n a L ,Ml v = m^ s ,O s = o s ,V s ,B,U s ) 



>n s , 3 -2-^ Lnri " } - 5 % (A-5) 

where 5 S = o(l). Let n s 3 = (1 — S^Lnri 71 ^. 

Let M s = E S (M^, V s ). From the definition of E s , M s eM s = [l: 2"»- 3 ], and 



H(M S \YZ L , Os, V s )> H(M S \M SV , Y£ L , O s , V s ) 

seS 

>J2h(M s \M^ s7 Y: l 7 O s ,V s ) 

seS 

®Y, h (Ms\m£ v ,yz l ,o s ,v s ) 

ses 

> H(M S I M| Vs , Y: L ,O s ,V s ,l Bnn J 
ses 

> Y,H(M s \M^ sl YZ L ,O s ,V s ,B,H s )P{Br\H s ) (A-6) 



ses 

rL 



where (a) holds because M s is a deterministic function of (M^,V S ), and (b) holds since Vg\ s is independent of 

S\s 

h(m s \y:: l ,o s ,v s ) 



(M s ,Mk Y£ L , O s ,V s ). Since P(B D H„) > 1 - P(B C ) - P(W£), it follows from (A-6) that 



> £ H(M S \M^ S , Y^ L ,O s , V S ,B, H s )(l - 2~ n L- 1 - 2^ L+r >) 
ses 

> J2(n St3 - 2-^ Lnr - n) - s ')(l - 2- n L- 1 - 2- yL+ri ) 
ses 

>^2n s . 3 -e 4 , (A-7) 

ses 

where (a) follows from (A-5), and €4 can be made arbitrarily small. Following the same steps used in the above 
equations for each s £ S yields H(M S \Y£ L , O s , V s ) > 7i s , 3 -e 4 , and therefore, H(M S ) > H(M S \Y™ L ,O s , V s ) > 
n s,3 — £4- Let p Us denote the pdf corresponding to the uniform distribution over M. s . Then, D(pm a \\Pu a ) = 



n Sl 3 — H(M S ) < 64, and by Pinsker's inequality [21], c?tv (ps, , Pu s ) < \/0.5e4. Therefore, by the maximal 
coincidence theorem (Theorem 1.1. in Chapter 4 of [24]), there exists a joint distribution p Us .m B , such that if 

(U s , M s ) ~ p u ^m s , then P(f/ S 7^ M s ) = ^tv (.Pm s , _P« S ) < \/0-5e4. Given M s , let C/ s , the message at source s, be 
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the random variable generated from the conditional distribution p Us \m s - Since, for any a £ A s , Us — > Ms — > W a , 
therefore, by the data processing inequality [21], 

I(Us;YZ L )<I(Ms;YZ L )<e 4 , 

where the last step follows from (A-7). 

Finally, we need to compute the effect of the extra communication required for carrying messages (O s : s G S) 
and (V s : s £ S). To achieve this goal, we model the correlation between M s and {M s ^ t }tev s as a broadcast 
channel. Since P(M S 7^ M s _>. t ,for some t £ T> s ) < \T> s \e, and 

P(M S ^ M s -y t 1 for some t£V s ) = ]P P(M S ^ A'/ S ^ t , for some t £ V S \M S \ S = m S \ s )p(m S \ s ) , 

'"s\ s 6n„ eS \ s >f« 

there exists m^ s £ Yl veS \ s Mv, such that P(M S 7^ M s ^t , for some i G 2? s |Afsy s = m^ s ) < |X> s |e. Again by 
the Fano's inequality, since the messages are independent, 

I(M s ;M s ^ t \M s \ s = m sv ) > nr< n >(l - |X> a |e) - 1 

>n(r a -c)(l-|2?.|e)-l, (A-8) 

for all i G T> s . Fixing the input messages of nodes in S\s to rn* s ^ s , consider the broadcast channel from node s to 
nodes in T> s , described by p((m s _>t)tgx> a \ni s , Ms\ s = m s\s)- Since (A-8) holds for every t £ T> s , the common 
rate capacity of this cannel is at least n(r s — e)(l — \D\e) — 1. To achieve this rate, node s generates its messages 
from uniform distribution over Ai s - Repeating this process |<S| times, all the required extra messages, i.e., Os 
and Vs, are carried to their intended receivers with arbitrarily small probability of error. Overall, these operations 
increase the blocklength from Ln by 

^<JiLnr£ n) + L(nri n) e+1) 

2. (ra _ c) (l-|P|6)-„-i ~ Ln62 > 

where 62 can be made arbitrarily small. 

Let M s _>t, V s ^t and O s ^t denote the reconstructions of U s , V s and O s , at sink node t £ T) s , respectively. By 

the union bound, 

P(U S ^ M_> t ) < P(U S ^ M s ) + P(A/ S L ± M^ t ) + P((V s ,O s ) jt (V s ^ t ,O s ^ t )), (A-9) 
which can be made arbitrarily small. 
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